4 ms·

A [somewhat exaggerated] summary: "there are so many security holes in web browsing already, why do you begrudge us a few more?". OK, I admit there is a kind of

A [somewhat exaggerated] summary: "there are so many security holes in web browsing already, why do you begrudge us a few more?". OK, I admit there is a kind of madhouse logic to this which I can't refute. There is already a flood of patches that I need to apply about every 5 minutes to something or other, and that's just the vulns that got identified and reported. I certainly agree that nobody will be able to stop this - developers want the API, users want the games. WebGL is currently turned on in Chrome 12, and the only way to turn it off is to add -disable-webgl to the command line. Which essentially means you can assume it's on everywhere, including on the computer of your bank's manager. This is what people miss when they say you can turn it off for yourself. The security aspects of WebGL seem like they were banged out in about 10 minutes. I encourage all to read the Khronos paper on security (http://www.khronos.org/webgl/security/ http://www.khronos.org/webgl/security/), and compare the level of presentation to anything which gets accepted at a security conference. I don't know why I keep returning to this. I certainly don't think that WebGL is the end of the world. There will be some more holes and some more patches. I just think this is another case of the web development world shirking its responsibility to bring real security to browsing (what happened to all those projects which used virtualization to isolate sessions, which I first heard about 4 years ago?), and instead piling on more features without thinking the implications through.

nickolai 15y ago
Your bank's manager likely has IE6, so WebGL is probably not the main security issue in that particular area.
yaakov34 15y ago
Oh, and since people misunderstood me in the previous thread, let me add that I am not a Microsoft/Silverlight supporter. Frankly, I do not wish success to Silverlight. It's another technology that nobody really asked for, and it brings its own set of security holes, and it doesn't run on a lot of the platforms I want to use. As a user, I also don't like the whole experience of "plugins" or "applets", whether it's Flash or Java or anything else.
Deestan 15y ago
> A [somewhat exaggerated] summary: "there are so many security holes in web browsing already, why do you begrudge us a few more?" Alternative summary: A has X. B has X. It is inconsistent to bash A for X while promoting B.
- kia 15y ago
  Wrong. B has bug X in Beta and supposedly don't have it in final release. It's easy to fix single implementation (Silverlight) in case of new bugs, but it is difficult to fix the standard.
ZeroGravitas 15y ago
"there are so many security holes in web browsing already, why do you begrudge us a few more?" I think this is a valid argument. You see a lot of arguing about things online where something being slower, more expensive, harder to use, less secure, more radioactive etc. is presented as a case-winning argument, without anyone bothering to quantify the problem or put it in context. The world isn't build on absolutes, unless you can guesstimate how much less secure or more radioactive something will be (a banana worth or a chernobyl worth) then why should I care? If we're really taking the absolutist stance that nothing that introduces a potential security issue (or the slightest additional radioactivity) is allowed then we might as well abandon all technology and go back to living in caves. At least try to make a case that WebGL, if not strangled at birth, will create a noticeably less safe web than would exist in a world with all the current issues, all the ones associated with Silverlight and Flash using GPUs, and all the new issues from whatever other features are added to browsers, computers or smartphones over the same timeframe.
- yaakov34 15y ago
  There is also such a thing as opportunity cost. Web browsing, and the online world in general, is execrably insecure. A day doesn't pass without a high-profile target being owned by some attention-seeking script kiddie. I can only imagine what serious malware syndicates, who don't advertise themselves to the whole world, have been up to. And what does the web development world want to do? It wants WebGL and a bunch of other shiny new APIs. As a user, I am just annoyed by this. I also work on stuff that needs to be secure, and if I wanted to add bells and whistles and dancing monkeys and make security worse instead of fixing it, I'd be told "no." Actually, I would never propose it. Now I realize that the complaint is directed at no one in particular, but I still can't help being annoyed. Now, this WebGL thing in particular has every security researcher saying "don't expose GPU drivers to this." And the web developers' response is essentially "nyah nyah, you're getting this anyway and you can't stop it". Or "what are you, a Microsoft stooge? They are doing it too." Or just "go away and stop harshing my mellow" (around here, the way of doing that is with a downvote). Well, OK, enough out of me on this subject.

nickolai 15y ago

Your bank's manager likely has IE6, so WebGL is probably not the main security issue in that particular area.

yaakov34 15y ago

Oh, and since people misunderstood me in the previous thread, let me add that I am not a Microsoft/Silverlight supporter. Frankly, I do not wish success to Silverlight. It's another technology that nobody really asked for, and it brings its own set of security holes, and it doesn't run on a lot of the platforms I want to use. As a user, I also don't like the whole experience of "plugins" or "applets", whether it's Flash or Java or anything else.

Deestan 15y ago

> A [somewhat exaggerated] summary: "there are so many security holes in web browsing already, why do you begrudge us a few more?" Alternative summary: A has X. B has X. It is inconsistent to bash A for X while promoting B.

kia 15y ago
Wrong. B has bug X in Beta and supposedly don't have it in final release. It's easy to fix single implementation (Silverlight) in case of new bugs, but it is difficult to fix the standard.

ZeroGravitas 15y ago

"there are so many security holes in web browsing already, why do you begrudge us a few more?" I think this is a valid argument. You see a lot of arguing about things online where something being slower, more expensive, harder to use, less secure, more radioactive etc. is presented as a case-winning argument, without anyone bothering to quantify the problem or put it in context. The world isn't build on absolutes, unless you can guesstimate how much less secure or more radioactive something will be (a banana worth or a chernobyl worth) then why should I care? If we're really taking the absolutist stance that nothing that introduces a potential security issue (or the slightest additional radioactivity) is allowed then we might as well abandon all technology and go back to living in caves. At least try to make a case that WebGL, if not strangled at birth, will create a noticeably less safe web than would exist in a world with all the current issues, all the ones associated with Silverlight and Flash using GPUs, and all the new issues from whatever other features are added to browsers, computers or smartphones over the same timeframe.

yaakov34 15y ago
There is also such a thing as opportunity cost. Web browsing, and the online world in general, is execrably insecure. A day doesn't pass without a high-profile target being owned by some attention-seeking script kiddie. I can only imagine what serious malware syndicates, who don't advertise themselves to the whole world, have been up to. And what does the web development world want to do? It wants WebGL and a bunch of other shiny new APIs. As a user, I am just annoyed by this. I also work on stuff that needs to be secure, and if I wanted to add bells and whistles and dancing monkeys and make security worse instead of fixing it, I'd be told "no." Actually, I would never propose it. Now I realize that the complaint is directed at no one in particular, but I still can't help being annoyed. Now, this WebGL thing in particular has every security researcher saying "don't expose GPU drivers to this." And the web developers' response is essentially "nyah nyah, you're getting this anyway and you can't stop it". Or "what are you, a Microsoft stooge? They are doing it too." Or just "go away and stop harshing my mellow" (around here, the way of doing that is with a downvote). Well, OK, enough out of me on this subject.